Access control: Cache basic roles and teams permissions (#87043)

* RBAC: Cache basic roles permissions

* Cache teams permissions

* Set cache TTL to 1 minute

* Add OSS implementation

* Fetch basic role permissions correctly

* fix conflict_user_command

* Fix teams permissions query

* Add traces for GetUserPermissions

* Fix folders tests

* Fix colflict user command

* Update store mock

* Fix linter error

* Reuse GetUserPermissions for fetching basic roles

* tests for GetTeamsPermissions

* pre-allocate slice capacity

* Fix linter

pkg/services/accesscontrol/actest/fake.go

@@ -76,16 +76,26 @@ func (f FakeAccessControl) RegisterScopeAttributeResolver(prefix string, resolve
 }
 
 type FakeStore struct {
-	ExpectedUserPermissions  []accesscontrol.Permission
-	ExpectedUsersPermissions map[int64][]accesscontrol.Permission
-	ExpectedUsersRoles       map[int64][]string
-	ExpectedErr              error
+	ExpectedUserPermissions       []accesscontrol.Permission
+	ExpectedBasicRolesPermissions []accesscontrol.Permission
+	ExpectedTeamsPermissions      map[int64][]accesscontrol.Permission
+	ExpectedUsersPermissions      map[int64][]accesscontrol.Permission
+	ExpectedUsersRoles            map[int64][]string
+	ExpectedErr                   error
 }
 
 func (f FakeStore) GetUserPermissions(ctx context.Context, query accesscontrol.GetUserPermissionsQuery) ([]accesscontrol.Permission, error) {
 	return f.ExpectedUserPermissions, f.ExpectedErr
 }
 
+func (f FakeStore) GetBasicRolesPermissions(ctx context.Context, query accesscontrol.GetUserPermissionsQuery) ([]accesscontrol.Permission, error) {
+	return f.ExpectedBasicRolesPermissions, f.ExpectedErr
+}
+
+func (f FakeStore) GetTeamsPermissions(ctx context.Context, query accesscontrol.GetUserPermissionsQuery) (map[int64][]accesscontrol.Permission, error) {
+	return f.ExpectedTeamsPermissions, f.ExpectedErr
+}
+
 func (f FakeStore) SearchUsersPermissions(ctx context.Context, orgID int64, options accesscontrol.SearchOptions) (map[int64][]accesscontrol.Permission, error) {
 	return f.ExpectedUsersPermissions, f.ExpectedErr
 }

pkg/services/accesscontrol/actest/store_mock.go

@@ -1,4 +1,4 @@
-// Code generated by mockery v2.42.0. DO NOT EDIT.
+// Code generated by mockery v2.43.0. DO NOT EDIT.
 
 package actest
 
@@ -33,6 +33,24 @@ func (_m *MockStore) DeleteExternalServiceRole(ctx context.Context, externalServ
 	return r0
 }
 
+// DeleteTeamPermissions provides a mock function with given fields: ctx, orgID, teamID
+func (_m *MockStore) DeleteTeamPermissions(ctx context.Context, orgID int64, teamID int64) error {
+	ret := _m.Called(ctx, orgID, teamID)
+
+	if len(ret) == 0 {
+		panic("no return value specified for DeleteTeamPermissions")
+	}
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(context.Context, int64, int64) error); ok {
+		r0 = rf(ctx, orgID, teamID)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
 // DeleteUserPermissions provides a mock function with given fields: ctx, orgID, userID
 func (_m *MockStore) DeleteUserPermissions(ctx context.Context, orgID int64, userID int64) error {
 	ret := _m.Called(ctx, orgID, userID)
@@ -51,22 +69,64 @@ func (_m *MockStore) DeleteUserPermissions(ctx context.Context, orgID int64, use
 	return r0
 }
 
-// DeleteTeamPermissions provides a mock function with given fields: ctx, orgID, teamID
-func (_m *MockStore) DeleteTeamPermissions(ctx context.Context, orgID int64, teamID int64) error {
-	ret := _m.Called(ctx, orgID, teamID)
+// GetBasicRolesPermissions provides a mock function with given fields: ctx, query
+func (_m *MockStore) GetBasicRolesPermissions(ctx context.Context, query accesscontrol.GetUserPermissionsQuery) ([]accesscontrol.Permission, error) {
+	ret := _m.Called(ctx, query)
 
 	if len(ret) == 0 {
-		panic("no return value specified for DeleteTeamPermissions")
+		panic("no return value specified for GetBasicRolesPermissions")
 	}
 
-	var r0 error
-	if rf, ok := ret.Get(0).(func(context.Context, int64, int64) error); ok {
-		r0 = rf(ctx, orgID, teamID)
+	var r0 []accesscontrol.Permission
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, accesscontrol.GetUserPermissionsQuery) ([]accesscontrol.Permission, error)); ok {
+		return rf(ctx, query)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, accesscontrol.GetUserPermissionsQuery) []accesscontrol.Permission); ok {
+		r0 = rf(ctx, query)
 	} else {
-		r0 = ret.Error(0)
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).([]accesscontrol.Permission)
+		}
 	}
 
-	return r0
+	if rf, ok := ret.Get(1).(func(context.Context, accesscontrol.GetUserPermissionsQuery) error); ok {
+		r1 = rf(ctx, query)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// GetTeamsPermissions provides a mock function with given fields: ctx, query
+func (_m *MockStore) GetTeamsPermissions(ctx context.Context, query accesscontrol.GetUserPermissionsQuery) (map[int64][]accesscontrol.Permission, error) {
+	ret := _m.Called(ctx, query)
+
+	if len(ret) == 0 {
+		panic("no return value specified for GetTeamsPermissions")
+	}
+
+	var r0 map[int64][]accesscontrol.Permission
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, accesscontrol.GetUserPermissionsQuery) (map[int64][]accesscontrol.Permission, error)); ok {
+		return rf(ctx, query)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, accesscontrol.GetUserPermissionsQuery) map[int64][]accesscontrol.Permission); ok {
+		r0 = rf(ctx, query)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(map[int64][]accesscontrol.Permission)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, accesscontrol.GetUserPermissionsQuery) error); ok {
+		r1 = rf(ctx, query)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
 }
 
 // GetUserPermissions provides a mock function with given fields: ctx, query